General
-
Target
archive.7z
-
Size
112.3MB
-
Sample
250420-k8b7mstlz9
-
MD5
93e08c28fa7099c6053c61d817590600
-
SHA1
938067bef66242ddfe538816372844ef04b12afb
-
SHA256
cecc051a6568f2e60daa72a70d81b69c0e929f11503f28904b3204ecd38a7111
-
SHA512
12bff3146503d443f63854fa9df770e66a0c18ce0f5d4c554728957b303cd678c3079927f7ae97bbc993d395673e48dbe2ba453642d127ce1577e95797fe75c2
-
SSDEEP
1572864:ldosNbFsPGiKzspvJxO+8v/0jMlECcnT4hnb4kvVsSfIUk0JrlIzNr7aPHIRN2st:XXLssGh7T4hnck9JQwI4g2sLks
Malware Config
Extracted
https://micfriosogprodnorthghostcom.top/kjgkjlKLkjfjkrhjHRGHKLNMREJGHKJnlGKL3454345BFJKKJnVBEKERJKRGEGREGRGERGERWBFDGGBTfgfbergsc4334ggd/lice
https://micfriosogprodnorthghostcom.top/kjgkjlKLkjfjkrhjHRGHKLNMREJGHKJnlGKL3454345BFJKKJnVBEKERJKRGEGREGRGERGERWBFDGGBTfgfbergsc4334ggd/lice/NLOCK/
https://micfriosogprodnorthghostcom.top/kjgkjlKLkjfjkrhjHRGHKLNMREJGHKJnlGKL3454345BFJKKJnVBEKERJKRGEGREGRGERGERWBFDGGBTfgfbergsc4334ggd/lice
https://micfriosogprodnorthghostcom.top/kjgkjlKLkjfjkrhjHRGHKLNMREJGHKJnlGKL3454345BFJKKJnVBEKERJKRGEGREGRGERGERWBFDGGBTfgfbergsc4334ggd/lice/NLOCK/
Extracted
stealc
default
hdkxbax.click
-
url_path
/98e3554588153cc4.php
Targets
-
-
Target
Setup.exe
-
Size
44KB
-
MD5
f86507ff0856923a8686d869bbd0aa55
-
SHA1
d561b9cdbba69fdafb08af428033c4aa506802f8
-
SHA256
94f4fd6f2cb781ae7839ad2ee0322df732c8c7297e62834457662f8cde29dcbb
-
SHA512
6c1c073fc09498407b2c6b46d7a7e04c2db3c6f8d68c0dc0775211864c4508c48c2bd92e3849dc3805caacc856f9e31e1eea118661a55f526bfa61638f88c3da
-
SSDEEP
384:RozxIpl4504JaAystntGecMJ6gjpS1BO2NjrLVXjW9VBhKigecicWwnWzYDTFu:Rg04PGeZQG2NDVXjWLu1imL
Score10/10-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-